What Problem This Solves

When the CLI↔Gateway agent websocket timed out or closed mid-turn, openclaw agent silently re-ran the entire turn embedded in-process under a fresh gateway-fallback-<uuid> session. That automatic fallback had three structural problems:

1. Double execution of side effects. Transport loss is ambiguous: the Gateway may have accepted — and may still finish — the original turn (the CLI's default 600s deadline vs the Gateway's 48h turn deadline makes this realistic, per docs/cli/agent.md). The embedded re-run then executes the same message a second time: tools fire twice, messages send twice.
2. Continuity lie. --session-key callers got a status-ok reply from a fresh session with no conversation context — a result they should discard, produced at full cost.
3. Wrong host. The embedded run used the CLI host's local config/credentials, which is quietly wrong for a thin client pointed at a remote Gateway.

Two prior patches (a428765 fresh-session isolation, #111645 structured divergence marker) existed solely to fence confusion the fallback itself created.

Why This Change Was Made

Per the repo architecture bar, fallback is a product decision: name the shipped contract, failure mode, and removal plan — or delete it. The failure mode here is silent duplicate execution; the mechanism users actually need (--local) already exists as an explicit flag. Maintainer decision: remove the automatic path entirely.

User Impact

• A Gateway timeout / closed connection now fails the command (original error rethrown, non-zero exit) after the existing transient handshake retries, with a stderr hint: check openclaw gateway status and the session transcript before retrying or rerunning with --local, so an ambiguously-accepted turn is not executed twice. The hint deliberately does not recommend a blind retry, and does not present --local as session-isolated (it reuses the requested session key).
• --local is now the only embedded execution path; behavior of --local itself is unchanged.
• --json no longer emits meta.transport: "embedded" / meta.fallbackFrom / meta.fallbackReason / meta.fallback — these markers existed only to describe fallback runs (the meta.fallback shape shipped <1 day ago in fix(cli): surface gateway→embedded fallback session divergence in --json output #111645). Scripts now see a clean non-zero exit instead of a divergent success.
• Internal cleanup: the resultMetaOverrides plumbing (AgentCommandResultMetaOverrides, delivery-time merge) is deleted — the fallback was its only writer. Plugin SDK API manifest regenerated for the one-field shrink of AgentCommandOpts (internal-caller field; the type name was never exported by the SDK barrels).
• Docs updated: docs/cli/agent.md, docs/tools/agent-send.md, docs/automation/cron-jobs.md.

Evidence

• Net diff: +95 / −575 across 10 files; no live gateway-fallback / resultMetaOverrides references remain (repo-wide grep; one historical CHANGELOG entry untouched).
• Blacksmith Testbox tbx_01ky1f2xp98kv6r8ng82mrxmsb: focused pnpm test src/commands/agent-via-gateway.test.ts (71/71), src/agents/command/delivery.test.ts (52/52), src/cli/run-main.exit.test.ts — all green; full pnpm check:changed exit 0 (typecheck, lint, format, SDK manifest gates).
• New tests assert: timeout and transport-closed errors reject with the original error, the embedded command is never invoked, the --local hint appears; non-transport errors reject without the hint; transient handshake retries still run 6 attempts before failing.
• AutoReview (Codex gpt-5.6-sol, xhigh): two P1s on the initial hint wording (blind-retry advice; --local mis-described as fresh-session) — both fixed; final run clean, "patch is correct (0.93)".